Safety research firm PromptArmor recently released a report revealing a severe security vulnerability in Microsoft's AI agent service Copilot Cowork, part of Microsoft 365. Attackers can exploit a technique called "indirect prompt injection" to secretly steal and leak confidential files from an organization's internal cloud storage without user approval.

image.png

Malicious Instructions Hidden in Office Templates

As an integrated AI assistant, Cowork has high-level permissions to send emails, post Teams messages, and retrieve internal information from OneDrive and SharePoint. However, researchers found that attackers can hide malicious instructions in web pages, documents, or seemingly ordinary office automation templates (such as "Weekly Work Review") to lure the AI agent into action.

Once a user asks Cowork to process a file containing malicious prompts, the AI agent will be manipulated into falsely claiming it needs to generate a document preview. Subsequently, it will automatically fetch pre-authenticated download links for sensitive files and send these links back to the attacker via Teams messages, all done secretly in the background, making it extremely difficult for users to detect.

Timing Tasks Increase Risk and Are Difficult to Prevent

The report points out that due to Copilot Cowork's ability to perform tasks automatically on a schedule, this significantly amplifies the security risk. For example, automated tasks like "Weekly Report Summary," which are set to run periodically, can trigger and execute the attack chain repeatedly in the background, even when the user is away from their screen and not actively using the system.

In security testing, this attack method achieved an impressive success rate of 100% across five tests. Worse still, administrators have limited visibility and control over such "skill files," and the vulnerability is not only effective in automatic mode but also remains exploitable when explicitly calling more powerful large models like Claude Opus 4.7.